|
During mitigating a recent hardware failure (using another drive to boot from while waiting for the bad one to be fixed/replaced under warranty) I caused some self-inflicted damage. By mistake I reformatted(?) an ext3 partition to be used as swap because I thought that the partition has no useful data. I was wrong and now (after the failed drive is back) I realized that I was wrong... I have 4G memory and the partition was 4G also. I suspect that I did not run out of memory and needed the swap really. I was using a debian install CD and I do not recall that I asked for the partition to be cleared explicitly. What are my chances of recovering the contents of this partition? Any tool you can recommend? (The tags are not the best I am not allowed to create new ones: ext3 swap data-recovery). Thanks! |
|
Your chances are pretty good, but you have to be careful. The first rule of data recovery is: you always have a read-only copy. So, if there were failed drives, you should do a copy from this partition to another physical HDD and keep both read-only. Now, having the original on a suspect drive and a read-only copy on a trusted drive, make a working copy. mkswap by default should just create basic structures in the very beginning of the disk. The superblock (one of the most important parts of ext3 structure) lies there, but it is so important ext3 maintains a few copies anyway. So on a working copy you can run fsck.ext3 . I made an experiment - ran mkswap on an ext3 image. Just agreeing to everything fsck asks was enough to get the FS back. Please describe what fsck.ext3 says if that doesn't help. Maybe some real recovery tools will be needed. If you had a small amount of highly important text files, you can probably just get them back by finding known parts of their contents in raw partition data, of course. I indeed could fix the partition with e2fsck. (I also considered other recovery programs.) I backed up the partition first using dd and then ran e2fsck specifying the location to be used to read the superblock. (I used 4k block sizes and followed the manpage intructions.) e2fsck said it fixed a bunch of errors. I could recover all the important files and directories. This was a /var partition and I had mythtv/mysql databases that I cared about plus a chroot jail for cvs. This consisted < 5% of the partition so maybe I just got lucky.
(09 Jul '10, 15:55)
Matyas
|
|
Linux Data Recovery Recovers lost, formatted or deleted data from Linux based volumes A Linux Data Recovery software that helps you recover lost or inaccessible data from any Ext4, Ext3, Ext2, FAT32, FAT16, and FAT12 file system based LINUX volumes. Try:- http://www.recoverydeletedfiles.com/linux-data-recovery.html |
